CCI - Certified Cryptocurrency Investigator — Questions and Answers

Question 1: What role do blockchain explorers play in investigations?

They provide public access to transaction histories (Correct answer)
They hide transaction data
They allow editing of blocks
They generate new cryptocurrencies

Correct answer: They provide public access to transaction histories

Blockchain explorers are web-based tools that allow anyone to view and search the contents of a blockchain, including transaction histories, block details, and wallet balances. For investigations, they are invaluable as they provide public access to the immutable ledger, enabling investigators to track the movement of funds, identify transaction patterns, and gather crucial evidence directly from the blockchain.

Question 2: Why are cryptocurrency exchanges required to follow compliance regulations?

To prevent financial crimes (Correct answer)
To allow unlimited trading
To generate more profits
To increase mining output

Correct answer: To prevent financial crimes

Cryptocurrency exchanges are mandated to follow compliance regulations, such as AML and KYC, primarily to prevent financial crimes like money laundering, terrorist financing, and fraud. These regulations require exchanges to identify their users and monitor transactions for suspicious activity. By adhering to these rules, exchanges help to create a safer financial ecosystem and deter illicit use of cryptocurrencies.

Question 3: What is a 'chain hop' technique used by criminals on exchanges?

Moving funds between multiple bank accounts
Switching between different blockchain networks only once
Using VPNs to access geo-restricted exchanges
Rapidly converting funds through multiple cryptocurrencies to obscure the transaction trail (Correct answer)

Correct answer: Rapidly converting funds through multiple cryptocurrencies to obscure the transaction trail

Chain hopping involves converting funds through multiple cryptocurrencies in rapid succession to break the tracing trail and complicate forensic analysis.

Question 4: Which US government agency maintains primary AML/KYC regulatory authority over domestic cryptocurrency exchanges?

FinCEN (Financial Crimes Enforcement Network) (Correct answer)
Homeland Security Investigations (HSI)
FBI
DEA

Correct answer: FinCEN (Financial Crimes Enforcement Network)

FinCEN, a bureau of the US Treasury Department, holds primary AML/KYC regulatory authority over cryptocurrency exchanges registered as MSBs in the United States.

Question 5: What is 'depreciated value risk' in the context of cryptocurrency seized pending forfeiture proceedings?

The risk of hardware failure causing data loss on a seized wallet
The risk that highly volatile cryptocurrency prices may decline significantly while the government holds the assets during lengthy legal proceedings (Correct answer)
Legal fees that reduce the net value recovered from forfeited assets
Tax liability incurred by the government on seized cryptocurrency holdings

Correct answer: The risk that highly volatile cryptocurrency prices may decline significantly while the government holds the assets during lengthy legal proceedings

Cryptocurrency's extreme price volatility means seized assets may lose substantial market value during the months or years of legal proceedings before final disposition.

Question 6: According to the Financial Action Task Force (FATF), which of the following would be considered a Virtual Asset Service Provider (VASP)?

An individual who mines cryptocurrency for their own account.
A crypto-to-fiat exchange that facilitates trades on behalf of its customers. (Correct answer)
A software developer who writes the code for an open-source, non-custodial wallet.
An individual who uses cryptocurrency to purchase goods online.

Correct answer: A crypto-to-fiat exchange that facilitates trades on behalf of its customers.

FATF defines a VASP as any business that conducts activities like exchanging virtual assets for fiat, transferring virtual assets, or providing custody services on behalf of others. A crypto-to-fiat exchange clearly falls under this definition. Users and miners acting on their own behalf are generally not considered VASPs.

Question 7: During the execution of a search warrant, a Certified Cryptocurrency Investigator discovers a small, USB-like device. The suspect claims it is a simple storage drive. However, the investigator suspects it is a hardware wallet. Which of the following is the MOST critical piece of information to obtain from the suspect to access the funds associated with this device?

The PIN or passphrase for the device (Correct answer)
The public address of the wallet
The make and model of the device
A list of recent transaction hashes

Correct answer: The PIN or passphrase for the device

Hardware wallets are physical devices that store private keys offline. [1, 15] To access the wallet and authorize any transactions, an investigator would need the user's PIN, passphrase, or other authentication credentials. While other information is useful, the PIN/passphrase is the key to unlocking the device itself.

Question 8: What is the primary goal of cryptocurrency tracing?

To determine transaction purpose
To inflate market value
To follow fund movement across wallets (Correct answer)
To hack wallets

Correct answer: To follow fund movement across wallets

Cryptocurrency tracing aims to track the flow of digital assets from one wallet address to another across blockchain networks. This process is essential for investigations into illicit activities, fraud, or theft, as it helps identify the source and destination of funds. By analyzing transaction patterns, investigators can uncover connections and build a comprehensive picture of financial movements.

Question 9: What role do regulators play in the crypto space?

They block all transactions
They create new coins
They control mining rewards
They oversee legal compliance and protect markets (Correct answer)

Correct answer: They oversee legal compliance and protect markets

Regulators play a crucial role in the crypto space by establishing and enforcing rules to ensure legal compliance, protect investors, and maintain market integrity. They aim to prevent illicit activities like fraud and money laundering, while also fostering innovation responsibly. Their oversight helps to integrate cryptocurrencies into the broader financial system safely and securely.

Question 10: A group of traders coordinates on a social media platform to buy a low-volume altcoin simultaneously. They create a massive amount of hype with misleading information to attract outside investors, driving the price up significantly. The original group then sells all their holdings at the peak, causing the price to crash and leaving new investors with major losses. This scheme is best described as:

A rug pull
A Sybil attack
A pump-and-dump (Correct answer)
Phishing

Correct answer: A pump-and-dump

This scenario describes a pump-and-dump scheme. The key elements are the coordinated effort to artificially inflate ('pump') the price of an asset through hype and misleading statements, followed by the coordinated selling ('dump') of the asset by the insiders at the inflated price. This leaves later investors with a devalued asset.

Question 11: The Bitcoin protocol includes a mechanism to ensure that, on average, a new block is added to the blockchain approximately every 10 minutes, regardless of changes in the total network hash rate. What is this self-regulating feature called?

The Difficulty Adjustment (Correct answer)
Segregated Witness (SegWit)
The Halving
Proof-of-Stake Consensus

Correct answer: The Difficulty Adjustment

The Bitcoin network automatically adjusts the 'difficulty' of the mathematical problem miners must solve every 2,016 blocks (roughly every two weeks). If blocks are being found too quickly (faster than 10 minutes on average), the difficulty increases. If they are found too slowly, it decreases. This is known as the difficulty adjustment.

Question 12: Which tool is commonly used by investigators to analyze Ethereum smart contract source code, transactions, and token transfers?

Splunk
Etherscan (Correct answer)
Nessus
Wireshark

Correct answer: Etherscan

Etherscan is the primary blockchain explorer for Ethereum, allowing investigators to view verified smart contract source code, transaction histories, token transfers, and contract interactions.

Question 13: In the context of blockchain analysis, what is the primary goal of 'address clustering'?

To group multiple blockchain addresses that are likely controlled by the same individual or entity. (Correct answer)
To identify all addresses that were created by the same type of wallet software.
To group addresses that have transacted with each other within a specific timeframe.
To determine which addresses are associated with known illicit entities like darknet markets.

Correct answer: To group multiple blockchain addresses that are likely controlled by the same individual or entity.

Address clustering is a key technique in blockchain forensics. It involves using heuristics and analysis to identify and group different cryptocurrency addresses that are likely under the control of a single entity. This allows investigators to build a more complete picture of a suspect's on-chain activity rather than viewing each address in isolation.

Question 14: An investigator needs to advise a witness on how to securely store a large amount of cryptocurrency that will not be needed for frequent transactions. Which type of wallet would offer the highest level of security against online threats?

A custodial wallet on a major exchange.
A desktop software wallet.
A hardware wallet. (Correct answer)
A mobile wallet on a smartphone.

Correct answer: A hardware wallet.

A hardware wallet is a physical device that stores the user's private keys offline in a secure, isolated environment. Because the keys never touch an internet-connected computer, it is considered the most secure way to store cryptocurrency and protect it from online threats like malware and hacking. This is a form of 'cold storage'.

Question 15: What is the primary purpose of blockchain technology?

To store images and videos
To record and verify digital transactions (Correct answer)
To speed up internet access
To host email servers

Correct answer: To record and verify digital transactions

The primary purpose of blockchain technology is to provide a secure and transparent way to record and verify digital transactions. Each transaction is grouped into a 'block,' which is then cryptographically linked to the previous block, forming a chain. This creates an unchangeable and verifiable record of all activities on the network, ensuring trust without intermediaries.

Question 16: In the context of seized cryptocurrency, what is a 'government-controlled wallet'?

A regulated wallet that requires government-issued ID to open
An exchange account owned and operated by the US Treasury
A cryptocurrency address controlled by a law enforcement or government agency used to hold seized digital assets pending disposition (Correct answer)
A wallet issued by a central bank as part of a CBDC program

Correct answer: A cryptocurrency address controlled by a law enforcement or government agency used to hold seized digital assets pending disposition

A government-controlled wallet is a cryptocurrency address managed by a law enforcement agency (e.g., DOJ or USMS) used to custody seized digital assets until they are auctioned or forfeited.

Question 17: A criminal organization attempts to disrupt the Bitcoin network by controlling over half of the network's mining power. They successfully reverse their own recent transactions, effectively spending the same bitcoins twice. What is this type of attack called?

A 51% Attack (Correct answer)
A Phishing Attack
A Sybil Attack
A Dusting Attack

Correct answer: A 51% Attack

A 51% attack occurs when a single entity or group controls more than 50% of a blockchain network's total mining hashrate. This majority control allows them to manipulate the blockchain, prevent new transactions from gaining confirmations, and reverse their own transactions, leading to double-spending.

Question 18: How can collaboration help in cryptocurrency investigations?

Slows down reporting
Creates competition
Enhances success through combined resources (Correct answer)
Leads to data leaks

Correct answer: Enhances success through combined resources

Collaboration is highly beneficial in cryptocurrency investigations due to the global and complex nature of these crimes. By working with other law enforcement agencies, financial institutions, and blockchain analytics firms, investigators can combine expertise, share intelligence, and leverage diverse resources. This collective effort significantly enhances the chances of successfully tracing funds, identifying perpetrators, and bringing them to justice.

Question 19: When an exchange is located in a non-cooperative foreign jurisdiction, investigators typically obtain records through what mechanism?

Mutual Legal Assistance Treaty (MLAT) (Correct answer)
Direct subpoena to the foreign exchange
INTERPOL red notice
Bilateral tax treaty

Correct answer: Mutual Legal Assistance Treaty (MLAT)

An MLAT is the formal government-to-government legal mechanism for obtaining evidence and records from entities in foreign jurisdictions.

Question 20: An investigator is analyzing a series of Bitcoin transactions related to a darknet market. They notice that a suspect's address receives 5 BTC. The suspect then sends 1.5 BTC to another address. In the context of the UTXO model, what best describes the state of the original 5 BTC?

The original 5 BTC UTXO is flagged as 'spent' and archived, while a new 1.5 BTC UTXO is created for the recipient.
The original 5 BTC UTXO is now linked to the recipient's address, and the sender's balance is debited by 1.5 BTC.
The original 5 BTC UTXO is consumed, and two new UTXOs are created: one for 1.5 BTC and one for 3.5 BTC as change. (Correct answer)
The original 5 BTC UTXO is partially spent, with a remaining balance of 3.5 BTC.

Correct answer: The original 5 BTC UTXO is consumed, and two new UTXOs are created: one for 1.5 BTC and one for 3.5 BTC as change.

The Unspent Transaction Output (UTXO) model, used by Bitcoin, treats each transaction output as a discrete and indivisible chunk of cryptocurrency. When a user wants to spend from a UTXO, the entire output must be consumed. The transaction then creates new UTXOs: one for the payment amount to the recipient and another for the remaining amount (change) sent back to an address controlled by the sender.

Question 21: What is a block in a blockchain?

A container of transaction data (Correct answer)
A financial account
A security password
A peer-to-peer file

Correct answer: A container of transaction data

In a blockchain, a 'block' is a fundamental data structure that holds a collection of verified transactions. Each block also contains a timestamp, a reference to the previous block's hash, and a cryptographic hash of its own data. Once a block is filled and validated, it is added to the blockchain, becoming a permanent and immutable part of the ledger.

Question 22: What does MEV (Maximal Extractable Value) refer to in blockchain?

The maximum transaction fee a user is permitted to set on a network
The maximum amount of cryptocurrency that can be mined per day per miner
Profit extracted by validators by reordering, inserting, or censoring transactions within blocks (Correct answer)
The total market capitalization of all Ethereum-based tokens

Correct answer: Profit extracted by validators by reordering, inserting, or censoring transactions within blocks

MEV refers to the maximum value that can be extracted from block production by including, excluding, or reordering transactions within blocks, often at the expense of regular users.

Question 23: What is the primary purpose of a security audit in smart contract development?

To register the contract with regulatory authorities
To identify vulnerabilities and coding flaws before deployment (Correct answer)
To increase the contract's transaction throughput speed
To reduce gas fees for end users

Correct answer: To identify vulnerabilities and coding flaws before deployment

Smart contract audits involve expert review of code to identify security vulnerabilities, logic errors, and potential exploits before the contract is deployed to the immutable blockchain.

Question 24: A compliance officer at a US-based cryptocurrency exchange notices a series of incoming transactions for a single customer over a 24-hour period. The transactions are all from different wallets, each just under the $10,000 threshold, and total approximately $45,000. This pattern is MOST indicative of which illicit activity?

A 51% attack
Insider trading
Market manipulation
Structuring (Correct answer)

Correct answer: Structuring

Structuring, also known as 'smurfing', is the act of breaking up large financial transactions into multiple smaller transactions to avoid triggering currency transaction reporting (CTR) thresholds, which in the U.S. is $10,000. This pattern is a classic red flag for money laundering.

Question 25: A smaller, less-established Proof-of-Work (PoW) altcoin has experienced a sudden and significant reorganization of its blockchain, resulting in reversed transactions. This has allowed an attacker to double-spend a large amount of the altcoin. What type of attack has most likely occurred?

A phishing attack
A Sybil attack
A 51% attack (Correct answer)
A Distributed Denial-of-Service (DDoS) attack

Correct answer: A 51% attack

A 51% attack occurs when a single entity or group gains control of more than 50% of a blockchain network's mining hash rate. This majority control allows them to manipulate the blockchain, including preventing new transactions, halting payments, and, most notably, reversing their own transactions to double-spend coins. Smaller PoW blockchains are more vulnerable due to the lower hash rate required to achieve a majority.

Question 26: An investigator receives exchange records showing a customer used a US driver's license but IP login records show consistent logins from a foreign country. What does this most likely indicate?

A legitimate corporate account
Normal international travel patterns
An exchange system logging error
Possible identity fraud, a synthetic identity, or a money mule account (Correct answer)

Correct answer: Possible identity fraud, a synthetic identity, or a money mule account

Consistent foreign IP logins despite US identity documentation suggests potential use of a fraudulent or synthetic identity, or that the account belongs to a money mule.

Question 27: Which consensus mechanism is used by Bitcoin?

Delegated Proof of Stake
Proof of Work (Correct answer)
Proof of Authority
Proof of Stake

Correct answer: Proof of Work

Bitcoin, the first and largest cryptocurrency, utilizes the Proof of Work (PoW) consensus mechanism. In PoW, miners compete to solve complex cryptographic puzzles to validate new blocks of transactions and add them to the blockchain. This process requires significant computational power, securing the network and preventing fraudulent transactions by making it economically unfeasible to attack.

Question 28: In DeFi, what does TVL (Total Value Locked) measure?

The total number of token holders
The total trading volume in a 24-hour period
The total value of assets deposited in a DeFi protocol's smart contracts (Correct answer)
The total number of transactions on a DeFi platform

Correct answer: The total value of assets deposited in a DeFi protocol's smart contracts

TVL represents the total value of cryptocurrency assets deposited and locked within a DeFi protocol's smart contracts, indicating the protocol's size and adoption.

Question 29: What is a Suspicious Activity Report (SAR) and who is required to file it?

A quarterly tax filing submitted by exchanges to the IRS
A report filed by victims of crypto fraud to the FTC
A public police report filed by investigators
A confidential report filed by financial institutions including exchanges with FinCEN when suspicious activity is detected (Correct answer)

Correct answer: A confidential report filed by financial institutions including exchanges with FinCEN when suspicious activity is detected

A SAR is a confidential report that financial institutions (including crypto exchanges) must file with FinCEN when transactions suggest potential money laundering or other criminal activity.

Question 30: An investigator is analyzing a Bitcoin transaction that has been broadcast to the network but has not yet been included in a block. In which of the following locations would the investigator most likely find this transaction?

The victim's hardware wallet
A centralized exchange's hot wallet
The mempool of a Bitcoin node (Correct answer)
The Bitcoin genesis block

Correct answer: The mempool of a Bitcoin node

When a Bitcoin transaction is broadcast, it enters a 'waiting area' called the mempool (memory pool) on Bitcoin nodes. Miners select transactions from the mempool to include in the next block. Therefore, an unconfirmed transaction resides in the mempool of the nodes on the network.

Question 31: What is the benefit of decentralization in blockchain?

Slower performance
Increased energy costs
Greater transparency and resilience (Correct answer)
Less data security

Correct answer: Greater transparency and resilience

Decentralization in blockchain technology offers significant benefits, primarily greater transparency and resilience. With no single point of control, all participants can view the ledger, fostering transparency. The distributed nature means the network is highly resistant to attacks or failures, as there's no central server to target, ensuring continuous operation even if some nodes go offline.

Question 32: What does KYC stand for?

Keep Your Crypto
Keep Your Coins
Know Your Customer (Correct answer)
Know Your Client

Correct answer: Know Your Customer

KYC stands for "Know Your Customer" and refers to the process of verifying the identity of clients by financial institutions and businesses. This is a crucial part of AML (Anti-Money Laundering) regulations, requiring cryptocurrency exchanges to collect and verify personal information from their users. KYC helps prevent fraud, terrorism financing, and other illicit activities by ensuring that users are properly identified.

Question 33: Which of the following is the primary purpose of a cryptocurrency mixer or tumbler in the context of illicit activities?

To provide users with better exchange rates
To obscure the transaction trail and launder illicit funds (Correct answer)
To stake cryptocurrency for passive income
To facilitate faster cross-border payments

Correct answer: To obscure the transaction trail and launder illicit funds

Cryptocurrency mixers, also known as tumblers, are services that commingle cryptocurrencies from multiple users to break the link between the sender and receiver, thereby obscuring the transaction trail. This makes them a popular tool for money laundering and hiding the origin of funds obtained from criminal activities.

Question 34: What is a smart contract in the context of blockchain technology?

A legal document stored on a blockchain
Self-executing code deployed on a blockchain that automatically enforces agreement terms (Correct answer)
A digital signature on a financial contract
A cryptocurrency exchange service agreement

Correct answer: Self-executing code deployed on a blockchain that automatically enforces agreement terms

Smart contracts are self-executing programs stored on a blockchain that automatically enforce and execute the terms of an agreement when predetermined conditions are met.

Question 35: What is a governance token in DeFi?

A stablecoin used exclusively for paying transaction fees on a protocol
A token issued by government agencies for blockchain compliance purposes
A token that grants holders voting rights over protocol decisions and upgrades (Correct answer)
A token that represents fractional ownership of physical real-world assets

Correct answer: A token that grants holders voting rights over protocol decisions and upgrades

Governance tokens grant holders the right to vote on protocol changes, parameter adjustments, and treasury decisions, giving them decentralized influence over a DeFi protocol's development.

Question 36: What is AML in the context of cryptocurrency?

Automated Mining Loop
Anonymous Market Ledger
Anti-Money Laundering (Correct answer)
Asset Management Ledger

Correct answer: Anti-Money Laundering

AML stands for Anti-Money Laundering, a set of regulations and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. In the context of cryptocurrency, AML compliance requires exchanges and financial institutions to monitor transactions and report suspicious activities to combat financial crimes. This helps to maintain the integrity of the financial system.

Question 37: What is a hardware wallet and why does its physical possession matter in a cryptocurrency seizure?

An exchange's internal cold storage server
A physical device storing private keys offline; possession allows access to and seizure of the stored cryptocurrency (Correct answer)
A wallet constructed from metal for physical security
A printed paper containing a wallet address

Correct answer: A physical device storing private keys offline; possession allows access to and seizure of the stored cryptocurrency

A hardware wallet stores private keys on a tamper-resistant physical device; gaining possession of it (along with the PIN) enables access to and seizure of the associated funds.

Question 38: What is a smart contract?

An encrypted email
Code that executes agreements automatically (Correct answer)
A legal document signed digitally
A physical contract

Correct answer: Code that executes agreements automatically

A smart contract is a self-executing contract with the terms of the agreement directly written into lines of code. These contracts run on a blockchain, automatically executing and enforcing the terms when predefined conditions are met, without the need for intermediaries. This provides transparency, immutability, and efficiency for various applications beyond simple currency transfers.

Question 39: Which of the following best describes the primary function of a cryptocurrency mixer or tumbler in a financial investigation context?

To split a large transaction into smaller, less conspicuous transactions.
To provide a decentralized exchange platform for peer-to-peer trading.
To exchange one type of cryptocurrency for another, such as Bitcoin for Monero.
To pool and mix transactions from multiple users to obscure the trail of funds. (Correct answer)

Correct answer: To pool and mix transactions from multiple users to obscure the trail of funds.

A cryptocurrency mixer, or tumbler, is a service that intentionally obscures the link between a sender and a recipient by pooling funds from many users and redistributing them. This process breaks the direct on-chain link, making it significantly harder for investigators to trace the flow of illicit funds.

Question 40: An investigator is analyzing a series of Bitcoin transactions related to a darknet market seizure. They are using a blockchain analysis tool to trace the flow of funds. The investigator groups multiple addresses that are likely controlled by the same entity based on their transactional patterns. What is this specific forensic technique called?

Taint Analysis
Clustering (Correct answer)
Smart Contract Analysis
Address Attribution

Correct answer: Clustering

Clustering is a core technique in blockchain forensics used to group together multiple addresses that are likely controlled by the same entity. This is achieved by analyzing transaction patterns, such as co-spending of inputs, to deanonymize users and trace the flow of illicit funds. [10, 11]

Question 41: What is typically required before law enforcement can legally seize cryptocurrency held in a suspect's private wallet?

An administrative hold order from FinCEN
A seizure warrant issued by a judge based on probable cause (Correct answer)
Only a subpoena to the suspect
Verbal authorization from a supervising agent

Correct answer: A seizure warrant issued by a judge based on probable cause

Law enforcement must obtain a seizure warrant supported by probable cause before legally seizing cryptocurrency from a suspect's private wallet.

Question 42: Which of the following is a primary reason why cryptocurrencies like Monero and Zcash are increasingly favored over Bitcoin for illicit transactions on the dark web?

They offer enhanced privacy features that obscure transaction details. (Correct answer)
They are sponsored by major dark web marketplaces.
They can be mined more easily on standard computer hardware.
They have significantly lower transaction fees.

Correct answer: They offer enhanced privacy features that obscure transaction details.

Unlike Bitcoin, whose blockchain is public and pseudonymous, privacy coins like Monero and Zcash incorporate advanced cryptographic techniques (e.g., ring signatures, stealth addresses, zk-SNARKs) to conceal the sender, receiver, and transaction amount, making them more attractive for users seeking true anonymity on the dark web.

Question 43: What ensures the integrity of a blockchain?

Cryptographic hash linking blocks (Correct answer)
Manual timestamping
Central authority approval
Paper backups

Correct answer: Cryptographic hash linking blocks

The integrity of a blockchain is primarily ensured by cryptographic hashing, which links each new block to the previous one. Each block contains a unique hash of its own data and the hash of the preceding block. Any attempt to alter a past transaction would change that block's hash, invalidating all subsequent blocks and making tampering immediately detectable and practically impossible.

Question 44: When law enforcement seizes a cryptocurrency hardware wallet but does not know the PIN, what legal options exist?

Selling the locked device at auction without accessing funds
Immediately destroying the device as unusable evidence
Returning the device to the suspect as inaccessible
Seeking a court order compelling the suspect to disclose the PIN or using authorized forensic techniques to extract it (Correct answer)

Correct answer: Seeking a court order compelling the suspect to disclose the PIN or using authorized forensic techniques to extract it

Investigators may pursue compelled disclosure orders through the courts or employ authorized forensic techniques to extract the PIN, subject to applicable constitutional constraints.

Question 45: What is a re-entrancy attack in smart contract security?

A type of Sybil attack targeting validator nodes in a network
An exploit that reverses already-confirmed blockchain transactions
When an attacker forces a smart contract to call an external contract before completing its own state updates (Correct answer)
An attack where the same transaction is broadcast multiple times to the network

Correct answer: When an attacker forces a smart contract to call an external contract before completing its own state updates

A re-entrancy attack occurs when a malicious contract repeatedly calls back into the victim contract before the first execution's state updates are complete, allowing repeated unauthorized fund withdrawals.

Question 46: Why is regulatory compliance essential in investigations?

To meet legal standards and support prosecutions (Correct answer)
To increase exchange fees
To prevent system updates
To avoid writing reports

Correct answer: To meet legal standards and support prosecutions

Regulatory compliance is essential in investigations to ensure that all evidence collection, analysis, and reporting adhere to established legal standards and procedures. This adherence is critical for the admissibility of evidence in court and for building a strong, legally sound case that can withstand scrutiny. Proper compliance ultimately supports successful prosecutions of financial crimes.

Question 47: Why are case notes and documentation important in investigations?

To create news stories
To justify time logs
To ensure clear records for evidence and reporting (Correct answer)
To sell the case to media

Correct answer: To ensure clear records for evidence and reporting

Detailed case notes and thorough documentation are vital in any investigation, especially in complex cryptocurrency cases. They provide a clear, chronological record of all actions taken, evidence collected, and findings, which is essential for maintaining transparency and accountability. This documentation supports the investigative process, aids in report writing, and is critical for presenting a strong case in legal proceedings.

Question 48: A user attempts to open an account at a cryptocurrency exchange from an IP address that geolocates to a comprehensively sanctioned jurisdiction. The VASP's compliance systems block the account creation. This action is a direct result of adhering to the requirements set by which U.S. agency?

The Office of Foreign Assets Control (OFAC) (Correct answer)
The Securities and Exchange Commission (SEC)
The Commodity Futures Trading Commission (CFTC)
The Financial Crimes Enforcement Network (FinCEN)

Correct answer: The Office of Foreign Assets Control (OFAC)

The Office of Foreign Assets Control (OFAC) administers and enforces economic and trade sanctions. All U.S. persons and entities, including VASPs, are prohibited from transacting with individuals, entities, or entire jurisdictions on OFAC's sanctions lists. Using geolocation to block users from sanctioned regions is a key internal control for OFAC compliance.

Question 49: After cryptocurrency is legally forfeited to the US federal government, where do the auction proceeds typically go?

Exclusively to the crime victims who suffered losses
To local police departments that assisted in the investigation
Directly to the prosecuting attorney's office as a budget supplement
Into the DOJ Assets Forfeiture Fund, with portions shared with cooperating agencies and potentially directed toward victim restitution (Correct answer)

Correct answer: Into the DOJ Assets Forfeiture Fund, with portions shared with cooperating agencies and potentially directed toward victim restitution

Federal forfeiture proceeds flow into the DOJ Assets Forfeiture Fund, which distributes funds to cooperating law enforcement agencies and may fund victim restitution programs.

Question 50: What is the first step in a cryptocurrency investigation?

Freeze all accounts
Notify the media
Shutdown the blockchain
Gather wallet addresses and transaction data (Correct answer)

Correct answer: Gather wallet addresses and transaction data

The initial and most critical step in any cryptocurrency investigation is to gather all available wallet addresses and associated transaction data. This foundational information forms the basis for tracing funds, identifying involved parties, and understanding the flow of illicit assets. Without this initial data collection, further investigative steps would be impossible.

Question 51: Why is smart contract bytecode analysis important for cryptocurrency investigators?

Bytecode reveals deployed code logic and functionality even when human-readable source code is not publicly verified (Correct answer)
Bytecode analysis can be used to legally reverse or invalidate blockchain transactions
Bytecode contains the private keys of the contract creator in an encoded format
Bytecode reveals the wallet addresses and identities of all users who interacted with the contract

Correct answer: Bytecode reveals deployed code logic and functionality even when human-readable source code is not publicly verified

Analyzing smart contract bytecode allows investigators to reverse-engineer contract logic and identify functions even when the source code has not been publicly verified on explorers like Etherscan.

Question 52: A Certified Cryptocurrency Investigator is presenting evidence in a money laundering case. They need to explain how the suspect attempted to obscure the trail of stolen funds. The suspect sent their cryptocurrency to a service that pooled their funds with those of many other users before distributing them to new, clean addresses. What is this anonymization technique known as?

Forking
Mixing (or Tumbling) (Correct answer)
Airdropping
Chain Hopping

Correct answer: Mixing (or Tumbling)

Mixing, also known as tumbling, is a service that breaks the link between a sender and receiver by pooling transactions from multiple users and redistributing them. This makes it difficult for blockchain analysis tools to trace the original source of the funds, thereby enhancing anonymity. [17, 19]

Question 53: Which of the following BEST describes the primary function of blockchain analysis platforms like Chainalysis, Elliptic, or TRM Labs in a forensic investigation?

To execute smart contracts for recovering stolen assets.
To provide real-time risk scoring and trace the flow of funds across blockchains. [2] (Correct answer)
To create new cryptocurrency wallets for undercover operations.
To seize and secure cryptocurrency from suspect wallets.

Correct answer: To provide real-time risk scoring and trace the flow of funds across blockchains. [2]

Blockchain analysis platforms are specialized tools designed to de-anonymize transactions. Their primary function is to analyze blockchain data, trace the movement of funds, identify links between addresses and real-world entities, and provide risk scores for transactions associated with illicit activities like darknet markets or sanctioned addresses. [2, 6, 7]

Question 54: During a search warrant execution at a suspect's residence, investigators find a piece of paper with 24 words written in sequence. What is this most likely?

A social media account password list
An encrypted cipher code
A BIP-39 cryptocurrency wallet seed phrase (mnemonic recovery phrase) (Correct answer)
A shopping list in a foreign language

Correct answer: A BIP-39 cryptocurrency wallet seed phrase (mnemonic recovery phrase)

A 24-word sequence found during a search is almost certainly a BIP-39 mnemonic seed phrase, which can be used to recover and access a cryptocurrency wallet.

Question 55: A Certified Cryptocurrency Investigator is tasked with tracking the flow of funds from a ransomware attack. Which tool is essential for viewing transaction histories, wallet balances, and the movement of cryptocurrency on a public blockchain?

A cold storage wallet
A decentralized application (dApp) browser
A mining software client
A block explorer (Correct answer)

Correct answer: A block explorer

A block explorer is a web-based tool that functions like a search engine for a blockchain. It allows anyone to view detailed information about blocks, addresses, and transactions on the public ledger. For an investigator, this is a fundamental tool for tracing the path of cryptocurrency from one address to another.

Question 56: What does clustering refer to in blockchain analysis?

Splitting coins across networks
Grouping wallet addresses with common behavior (Correct answer)
Connecting unrelated coins
Making transaction backups

Correct answer: Grouping wallet addresses with common behavior

In blockchain analysis, clustering refers to the technique of identifying and grouping multiple wallet addresses that are likely controlled by the same entity or individual. This is done by analyzing transaction patterns, such as multiple inputs from different addresses into a single output, or shared transaction histories. Clustering helps investigators consolidate fragmented data and gain a clearer picture of an entity's financial activity.

Question 57: What is a 'dusting attack' and how might it be relevant to seizure investigations?

Physically attacking hardware wallets with compressed air to extract data
A brute-force method to crack wallet private keys
Sending tiny amounts of cryptocurrency to target addresses to deanonymize wallet owners by tracking how the dust is subsequently moved (Correct answer)
Flooding a network with spam transactions to cause congestion

Correct answer: Sending tiny amounts of cryptocurrency to target addresses to deanonymize wallet owners by tracking how the dust is subsequently moved

A dusting attack sends minuscule crypto amounts to target addresses; when recipients move the dust, it links their addresses together and can reveal wallet ownership.

Question 58: Which global group sets AML guidelines?

WHO
FATF (Correct answer)
FEMA
UNESCO

Correct answer: FATF

The Financial Action Task Force (FATF) is an intergovernmental organization established to combat money laundering, terrorist financing, and other related threats to the integrity of the international financial system. FATF sets international standards and promotes the effective implementation of legal, regulatory, and operational measures for these purposes. Its guidelines are globally recognized and influence AML policies for cryptocurrencies.

Question 59: A Certified Cryptocurrency Investigator is assigned a case where a ransomware payment was made using Monero. The victim provides the transaction ID. What is the most significant challenge the investigator will face when attempting to trace the funds on the public ledger?

The transaction ID is encrypted and can only be viewed by the Monero development team.
The sender's address, recipient's address, and transaction amount are all obscured by default. (Correct answer)
Monero's block time is too slow, causing significant data retrieval delays.
The transaction fees are too high for analysis tools to process.

Correct answer: The sender's address, recipient's address, and transaction amount are all obscured by default.

Monero is private by default, meaning every transaction automatically uses Ring Signatures (hiding the sender), Stealth Addresses (hiding the receiver), and RingCT (hiding the amount). Therefore, even with a transaction ID, an investigator cannot see the critical details of the transaction on the public blockchain, making it extremely difficult to trace.

Question 60: An investigator is analyzing a new cryptocurrency project that promised revolutionary returns. The developers, who remained anonymous, aggressively promoted the token on social media, causing a massive price surge. They then suddenly drained the project's liquidity pool and disappeared, leaving investors with worthless tokens. Which illicit scheme does this scenario describe?

A pump-and-dump scheme
A rug pull (Correct answer)
A Ponzi scheme
A 51% attack

Correct answer: A rug pull

This scenario is a classic example of a rug pull, where developers abandon a project and run away with investors' funds. A key characteristic is the removal of liquidity by the project creators, making it impossible for investors to sell their tokens. While it has similarities to a pump-and-dump, the defining action in a rug pull is the developer's exit and liquidity drain, which is specific to the DeFi space.

CCI - Certified Cryptocurrency Investigator

The CCI certification, offered by Blockchain Intelligence Group, validates expertise in cryptocurrency investigation, blockchain forensics, dark web operations, and digital asset tracing for law enforcement and financial investigators.

Questions

90 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds